sockbuf drop/flush family ignores M_SOLOCKED — latent use-after-free window against sorecvtcp's token-released uiomove loop

Summary

sorecvtcp marks a window of so_rcv mbufs M_SOLOCKED, releases the ssb token, and uiomoves directly out of them. The design contract is that every concurrent mutator honors the flag; but only sbcompress checks it. sbdrop, sbdroprecord, sbflush and sbunlinkmbuf will trim/unlink/free M_SOLOCKED mbufs without any check — a concurrent flush during the unlocked uiomove loop would yield a kernel UAF read (freed mbuf data copied to userspace) and a freed-pointer chase. Today latent: for TCP the sole so_rcv mutators during a live recv are sbappendstream/sbcompress, the soclose-triggered sbflush is excluded by the recv syscall's file-reference hold, RST teardown does not flush so_rcv; the only in-tree so_rcv dropper on a protocol callback (sco_input) is bluetooth-hw-gated. Defense-in-depth: one new protocol or a sorecvtcp conversion turns this into a direct UAF. Fix: KKASSERT/skip M_SOLOCKED in the drop/flush family (row diff).

Timeline

• 2026-09-02 Discovered during pass-2 audit of uipc_sockbuf.c (GLM 5.3).